How do crypto payment gateways work?

[blubbaz]

Hey guys,

I was thinking about implementing a crypto payment gateway in my e-commerce website. But I need a better fundamental understanding of this.

Let's do it super simple:

If something was bought by a user, my wallet will show up so user knows where to send his coins.

But how is a system able to recognize this particular payment was done?

What if someone else just bought the same product and sent amount to this wallet?

So would it be necessary to create a new wallet for every payment? Is this how popular systems work?

Anyone got a better understanding of this?

[BlackHatCoiner]

But how is a system able to recognize this particular payment was done?

The system must be programmed to keep track of your wallet's transactions. Each time someone wants to buy something, he'll get a unique address and your system will save in its database that this address corresponds to that purchase. It will recognize that the payment was done if your server runs a Bitcoin node and verifies it or by trusting another node for delivering this information.

What if someone else just bought the same product and sent amount to this wallet?

Each customer gets a unique address. This is how you'll categorize them.

[BrewMaster]

you start by using something called "deterministic wallet" which is where you have two master keys, one is your master private key and another is your master public key. you obviously keep the first one offline and in a secure place and the second online on your server where it derives new (public) keys for each payment and keeps track of everything. if your server gets hacked it is only a privacy issue but you won't lose money.

each time a user purchases something your server automatically generates a new address and shows it to that user then keeps track of that "address" in the background.
for example if it is purchase 75364 it derives the 75364th address from that master public key and shows it to the user.
you no longer care who pays, as long as you receive the payment in that address you release the product.
for next purchase by another user you generate 75365th address.
this way each user has their own "invoice" and your server can automatically create and keep track of all of them.

 and there is virtually no limit on how many of these you can create. you go from #0 to #1,099,511,627,527 then when you run out you simply go to your cold storage (master private key) and generate the next master public key for the next account.
for example m/44'/0'/0'/0... then m/44'/0'/1'/0 then m/44'/0'/2'/0

the key derivation scheme explained above is known as BIP32.

[NotATether]

I'm in charge of building a crypto payment processor for my organization so I can give more insight.

Basically for each purchase, you have to assign a tracking ID to it with fields stored in a database for the source and destination addresses, amounts, confirmation status, and other metadata such as logged-in user if applicable.

You have to make the payment processor periodically query the backend for the transaction confirmation status; if it has been confirmed then you approve the request for whatever service or good has been purchased. If it's cancelled you act as if nothing happened.

Payment processors might put an expiry date on transactions to prevent them from waiting indefinitely on "ghost" (abandoned) payments.

Payment processors must handle the actual shift of funds from the destination address to any other business-controlled addresses and for that they might either make a connection to Bitcoin Core or other full node, or use an exchange's API to send crypto to that.

There might also be a control plane for operators to inspect the transactions themselves in the database.

[AverageGlabella]

A good system would not give you unique addresses well not by its definition. Instead they would give you a time specific unique address. In other words it would be unique for x amount of time and then they would reuse that address if it did not receive anything in the given amount of time. The amount of time is usually 12-24 hours for 1 confirmation but can vary from provider to provider. Ideally you want to have one that allows sufficient time for network congestion while not open for too long that it hogs your resources constantly checking it. If you are a small merchant with little traffic it is not that bad to keep checking but once things start getting more and more traffic you will want to squeeze every bit out of performance.

Bitpay is probably the most popular in the last decade but custom payment processors seem to be taking over as of recent as people are wising up that they can cut the middle man out and make their own. Depending on your needs it might be worth considering that option.

To answer your last question it wouldn't need to be a new WALLET but a new address. One wallet can create as many addresses as you would like.

[BlackHatCoiner]

I think you meant each transaction, a customer could buy same product twice.

Yes. The payee will have a database full of Bitcoin addresses, preferably derived from a master public key, along with an extra empty column. Each time a person clicks to finish his shopping cart, the database will update that column with the selected products he wants to buy. The buyer will get the specific's row Bitcoin address for funding.

I believe there's a simple way for the merchant's server to verify the transaction's confirmations.

Besides BitPay, do you have any other scripts in mind?

[DannyHamilton]

A good system would not give you unique addresses . . . it would be unique for x amount of time and then they would reuse that address

No.

No, no, no.

There is no need to re-use addresses.  Once you've given an address to a customer for them to use to pay you for a transaction, you should NOT give that same address to any other customer ever again.  You should not even give that address to the same customer for a different transaction.

[NotATether]

A good system would not give you unique addresses . . . it would be unique for x amount of time and then they would reuse that address

No.

No, no, no.

There is no need to re-use addresses.  Once you've given an address to a customer for them to use to pay you for a transaction, you should NOT give that same address to any other customer ever again.  You should not even give that address to the same customer for a different transaction.

With the reason being, that you'll confuse the PP system by not being able to tell which internal transaction number a crypto payment was intended for once it confirms.

[khaled0111]

Yes. The payee will have a database full of Bitcoin addresses, preferably derived from a master public key, along with an extra empty column. Each time a person clicks to finish his shopping cart, the database will update that column with the selected products he wants to buy.

I believe it will be more efficient if the system generates the new receiving address and add it to the database along with the other data only when a new order is created. This will minimize interaction with the database.

Besides BitPay, do you have any other scripts in mind?

You can use a self-hosted payment processor such as Btcpay and run your own server or use a third party service like Coinpayments (some members do not recommend using it).

[BitcoinBarrel]

It's very easy to generate an address and check the balance via api every minute or so.

[CounterEntropy]

But how is a system able to recognize this particular payment was done?

Generate unique address for each payment and monitor payment to it. May be you can have a timer running, within which time frame the payment needs to complete. Otherwise you'd stop monitoring that address.

What if someone else just bought the same product and sent amount to this wallet?

Address is unique for each payment. So, this confusion will never occur.

So would it be necessary to create a new wallet for every payment?

A wallet is a collection of addresses, which can be accessed from the same seed/phrase. You generate new address for each payment. Not wallet.

Is this how popular systems work?

Not sure what do you mean by popular. But, this is standard practice. https://btcpayserver.org is an open source implementation of such a payment gateway.

Anyone got a better understanding of this?

Hope you understood the basics.

[odolvlobo]

I was thinking about implementing a crypto payment gateway in my e-commerce website. But I need a better fundamental understanding of this.

It might be easier and safer to integrate btcpay server (https://btcpayserver.org/) into your site rather than creating your own. I strongly recommend it. There are so many things that could go wrong if you do it yourself, especially if you are not familiar with the Bitcoin protocols and best practices.